HPE Aruba Networking Central Plugin for Risk Exchange

This document explains how to configure the HPE Aruba Networking Central v1.0.0 plugin with the Risk Exchange module of the Netskope Cloud Exchange platform. This plugin is used to fetch Wired and Wireless clients data from Aruba Networking Central of HPE Greenlake. It retrieves the clients from the Aruba Networking Central > Clients page. This plugin also supports performing Add client to blacklist, Remove client from blacklist, and Disconnect client from networking device actions on Aruba Networking Central.

Prerequisites

To complete this integration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
• Connectivity to the HPE GreenLake platform.
• A subscription for HPE Aruba Networking Central service.
• Access to generate Client ID, Client Secret, and pull wired/wireless clients.
• Connectivity to the following host: https://*.central.arubanetworks.com.

HPE Aruba Networking Central Plugin Support

This plugin is used to fetch Wired and Wireless clients data from Aruba Networking Central of HPE Greenlake. It retrieves the clients from the Aruba Networking Central > Clients page. This plugin also supports performing Add client to blacklist, Remove client from blacklist, and Disconnect client from networking device actions on Aruba Networking Central.

Mappings

Mappings are used to view the pulled wired and wireless clients and their respective details. Fields mapped during plugin configuration will be visible on the Records page after the data is pulled. Here are the suggested mappings to use while configuring the plugin.

Pull Mappings

Permissions

For fetching clients and performing actions using the plugin, you will need these roles:

• HPE Greenlake Platform > Workspace Observer
• HPE Aruba Networking Central > Aruba Central view edit role

API Details

{"status":true}

{
    "Server": "openresty/1.13.6.2",
    "Date": "Wed, 16 Apr 2025 09:36:57 GMT",
    "Content-Type": "application/json",
    "Content-Length": "16",
    "Connection": "keep-alive",
    "X-RateLimit-Limit-Second": "3",
    "X-RateLimit-Remaining-Second": "0",
    "Cache-Control": "no-cache, no-store, must-revalidate, private",
    "Pragma": "no-cache",
    "Set-Cookie": "csrftoken=IjdkMGABRFVkYTA23ftqN2M3ialjMDBiNjUyYTIzYzZiO83F2BViZDQi.Z_96OQ.6qxNHAMZKZOGqSHgPSYiy77Rg38; Secure; Path=/, session=e8067gfte772a53b_67ff7a39.OO4EUpf-lqpXP5QTvCD64flNbJy0; Secure; HttpOnly; Path=/"
}

{
   "auth_code": "dfmyIjq3cZ5G1ofsxS4Dgl122q0vQyE"
}

{
    "refresh_token": "knsdFAjnfEFks34adf76WDKW62jad",
    "token_type": "bearer",
    "access_token": "Nfjad8449NFf7asd0ea3wj3FFmwlald",
    "expires_in": 7200
}

{
    "refresh_token": "5nadsiuef7F7aFJ02pdam",
    "token_type": "bearer",
    "access_token": "naknfde7faoijfdioREMD9e3s",
    "expires_in": 7200
}

{
    "clients": [
        {
            "associated_device": "Network device 0",
            "associated_device_mac": "23:7f:de:3f:61:27",
            "associated_device_name": "23:7f:de:3f:61:27",
            "authentication_type": "",
            "band": 5,
            "channel": "100 (80 MHz)",
            "client_category": "Home Audio/Video Equipment",
            "client_type": "WIRELESS",
            "connected_device_type": "AP",
            "connection": "802.11ac",
            "encryption_method": "WPA2_PSK",
            "failure_stage": "",
            "group_id": 0,
            "group_name": "default",
            "health": 92,
            "hostname": "Google-Home",
            "ht_type": 5,
            "ip_address": "32.127.208.96",
            "label_id": [],
            "labels": [],
            "last_connection_time": 1742203795505,
            "macaddr": "27:88:56:2a:ac:c8",
            "manufacturer": "Google, Inc.",
            "maxspeed": 433,
            "name": "WirelessClient0",
            "network": "netskope",
            "os_type": "Chromecast Media Player",
            "phy_type": 1,
            "radio_mac": "23:7f:de:3f:61:27",
            "radio_number": 0,
            "signal_db": -64,
            "signal_strength": 4,
            "snr": 28,
            "speed": 325,
            "swarm_id": "1jLK1NxqiVhglBXXN2qA5BYiWuFCUejF2Fz8Yx5kRYORIiByix",
            "user_role": "netskope",
            "username": "user.name@domain.com",
            "vlan": 244
        }
    ],
    "count": 1
}

{
    "clients": [
        {
            "macaddr": "74:84:b4:11:af:b3",
            "name": "WiredClient0",
            "ip_address": "137.115.81.35",
            "username": "User.name@domain.com",
            "associated_device": "Network device 0",
            "group_name": "default",
            "interface_mac": "dd:e2:cb:7d:5c:fa",
            "interface_port": 63526,
            "vlan": 456,
            "associated_device_name": "dd:e2:cb:7d:5c:fa",
        }
    ],
    "count": 1
}

{
    "serial": "FT592BGL",
    "state": "QUEUED",
    "task_id": 17447940919521
}

Performance Matrix

These performance readings are conducted on a Large CE Stack with these VM specifications by pulling 500K wired clients and wireless clients from the HPE Aruba Networking Central plugin.

User Agent

netskope-ce-5.1.1-cre-hpe-aruba-networking-central-v1.0.0

Workflow

1. Get your API Base URL, Client ID, Client Secret and Customer ID from HPE GreenLake platform.
2. Configure the HPE Aruba Networking Central plugin.
3. Add a Business Rule.
4. Add Actions.
5. Validate the HPE Aruba Networking Central plugin.

Click play to watch a video.

Get your API Base URL, Client ID, Client Secret and Customer ID from HPE GreenLake

To get your API Base URL, Client ID, and Client Secret:

1. Log in to your HPE GreenLake account, and go to your workspace.
2. Go to Services > Catalog and search for HPE Aruba Networking Central.
3. Click on the service and click Add Region to deploy a service.
4. After successful deployment of the service, click Launch to start the service.
5. Go to Organization > Platform Integration and click REST API under the API Gateway section.
6. Under APIs you can find the API Base URL. You only need to copy the Base URL without the path to configure the plugin.
   For example: https://apigw-uswest5.central.arubanetworks.com.
7. To get the Client ID and Client Secret, go to My Apps & Tokens.
8. Click Add Apps & Tokens, and click Generate to generate the Client ID and Client Secret.
9. Save these to use while configuring the plugin.
10. For Customer ID, you click the Profile icon and copy the Customer ID.

Configure the HPE Aruba Networking Central Plugin

1. Log in to Cloud Exchange and go to Settings > Plugins. Search for and select the HPE Aruba Networking Central v1.0.o (CRE) plugin box.
2. Enter a plugin configuration name, and change the sync interval if needed. 
3. Click Next and enter the configuration parameters:
   • API Base URL: Your API Base URL for Aruba Networking Central instance. 
   • Username: Your HPE Greenlake account username.
   • Password: Your HPE Greenlake account password.
   • Client ID: Your Aruba Networking Central Client ID. 
   • Client Secret: Your Aruba Networking Central Client Secret. 
   • Customer ID: Your Aruba Networking Central Customer ID. 
   • Client Type: The Client Type to be fetched from Aruba Networking Central. Select at least one of the client types.

   

4. Click Next. Select the Entity from the Entity dropdown. The Entity fields can be created on the Schema Editor page, or using the + Add Field option from the field dropdown. Provide the field mappings. For the suggested mapping please, refer to the Mappings section.
5. Click Save.

Add a Risk Exchange Business Rule for HPE Aruba Networking Central

1. In Risk Exchange, go to Business Rules and click Create New Rule in the top right corner.
2. Enter the Rule Name. Select the Entity for the Fields that were configured for the HPE Aruba Networking Central plugin, and configure the query based on your requirements.
3. Click Save.

Add Risk Exchange Actions for HPE Aruba Networking Central

The HPE Aruba Networking Central plugin supports the following action types:

Add a Client to a Blacklist

This action will add clients to the blacklist on HPE Aruba Networking Central.

Remove a Client from a Blacklist

This action will remove clients from the blacklist on HPE Aruba Networking Central.

Disconnect a Client from a Networking Device

This action will disconnect the client from an existing networking device.

No Action

No action will be performed for this action. You can generate UBA alerts in Ticket Orchestrator by using this action and enabling the Generate Alerts toggle.

You can perform the Netskope related actions on the clients pulled from HPE Aruba Networking Central. For more information about actions and their validations, refer to the Risk Exchange guide.

Configure an Action

1. Go to Risk Exchange > Actions and click Add Action Configuration.
2. Select a Business Rule, a Configuration, and an Action from their respective dropdowns.
3. For the Disconnect a client from a networking device action, select the field that has the MAC Address, and select the field that has the Device Serial mapped.
4. Enable the Require Approval toggle if Approval is needed before performing action.
5. If Require Approval is enabled, then to approve the action, go to Risk Exchange > Action Logs, select the action to be approved, and click Approve. For the Add a client to a blacklist and Remove a client from a blacklist actions, you will have to provide the Client MAC Address and Swarm ID in the Action Parameters.
6. Click Save.
   

Validate the HPE Aruba Networking Central Plugin

Validate in Cloud Exchange

To verify the clients pulled from HPE Aruba Networking Central, go to Logging and search for the logs from CRE HPE Aruba Networking Central plugin.

To check the Disconnect client from the networking device, check the logs.

To check the records pulled and stored in Cloud Exchange, go to Records in Risk Exchange. Select the entity that you used while adding the mapping in the plugin configuration.

Validate in HPE Aruba Networking Central

The plugin pulls Wired and Wireless clients from HPE Aruba Networking Central. The clients are pulled from the Aruba Networking Central > Clients > Connected page.

To check the details of the client, click on any of the clients.

Troubleshooting HPE Aruba Networking Plugin

Receiving error in the plugin workflow

CRE HPE Aruba Networking Central [configuration_name]: Validation error occurred, Received exit code 401, Unauthorized, Verify Username, Password, Client ID, Client Secret and Customer ID provided in the configuration parameters.

What to do: Verify the Client ID and Secret for HPE Aruba Networking Central. Refer to the Get your API Base URL, Client ID, Client Secret and Customer ID from HPE GreenLake section.

Clients are not pulled from HPE Aruba Networking Central

If no data for the Clients are pulled, it might be due to one of these reasons:

• No client is available on the platform to pull
• Mapping is not added in the plugin

What to do:

1. Go to HPE Aruba Networking Central and check if the clients are available to pull from the Clients > Connected page.
2. Edit the plugin configuration, and check the Entity Source page. There should be some fields mapped in order to pull the clients.

Unable to perform action on HPE Aruba Networking Central

If any client failed while performing Disconnect client from networking device action, it might be due to one of these reasons:

• The client does not exist on HPE Aruba Networking Central.
• The client is offline at the point of time.

What to do:

To check the connected clients, refer to Validate in HPE Aruba Networking Central section.